Italy is the first EU Member State to enact national legislation on Artificial Intelligence ("AI"), thereby positioning itself as a frontrunner in shaping AI rule-making within the European Union.
On September 25, 2025, Italy adopted Law No. 132/2025 ("Law 132/2025"), which took effect on October 10 and introduced rules for "general-purpose" AI systems and models, consistent with EU Regulations 2016/679 ("GDPR") and 2024/1689 ("AI Act").
Law 132/2025 relies on the definitions set out in the AI Act without imposing any obligations beyond those provided therein and outlines key principles for AI systems, including transparency, proportionality, security, data protection, and non-discrimination, while preserving human decision-making autonomy. Indeed, AI use is confined to instrumental and support functions. Entities deploying such systems must inform third parties of their implementation in a "clear, simple, and exhaustive" way.
In addition to allocating public subsidies to companies operating in Italy in the field of AI, Law 132/2025 includes sector-specific provisions, such as:
- Health Care: Data processing—including personal and special categories of data—for the development of databases and AI models for scientific research and experimental purposes is recognized as a matter of substantial public interest with specific provisions on secondary use of data and preliminary notification to the Italian Data Protection Authority.
- IP: AI-generated content is protected under Italian copyright law, provided it stems from human intellectual effort.
- Labor: AI systems may be implemented to improve employees' working conditions, safety and productivity, provided that employers must inform employees about the use of AI and grant access to data processed therewith.
- Criminal Law: The use of AI in policing activities is envisaged and several new criminal offences related to the misuse of AI are introduced.
- E-Procurement: E-procurement platforms for contracting with the Public Administration shall favor suppliers of AI solutions and models that ensure data localization within data centers on the Italian territory.
The Agency for Digital Italy ("AgID") and the National Cybersecurity Agency ("ACN") are appointed as the national authorities ensuring compliance with both EU and Italian obligations.
In the 12 months following the entry into force of Law 132/2025, the Italian government shall adopt implementing decrees providing further guidance and technical standards to ensure the effective and consistent application of the new AI national regulatory framework.
